GDPR confusion and misinformation

GDPR confusion and misinformation

11:26 AM, 23rd April 2018, About 7 years ago 125

Text Size

I am told that ALL organisations, including private landlords (and their contractors), will have to be GDPR compliant by 25th May 2018. I have attending training on this and I’m getting contradictory advice from different GDPR professionals. About 4 weeks ago I was told that there is no need to register with the ICO, as everyone has to comply with GDPR so no need to register to do so, then earlier this week I was at an RLA event and was told that it would be necessary for everyone to register with the ICO, so these two GDPR speakers basically contradicted each other! The ICO website itself says that most data controllers (yes, that includes landlords) will need to register, unless they fall into an exemption (examples are on the ICO website).

At the RLA event earlier this week, I was told that we would need to provide all our tenants (and other people we hold data about) with a Privacy Notice. The RLA have one of these on their website that landlords can download, they said it is 30 pages long. I mentioned that there are probably a couple of hundred organisations that hold a persons data, so does that mean we can expect to receive 200 x 30 page documents arriving in the post in the next few weeks, and she said that most would be sent by email. I asked, what if the person does not have an email address, and she said then I could post them a hard copy, (so if you have any tenants who do not have an email address, they may be getting 6000 pages in the post very soon!!! (200 x 30 page documents). I asked if we could simply have the Privacy Notice on our website, and she was unsure whether this would be acceptable for not. She said that she only takes tenants if they have an email address, but clearly she deals with more affluent or well educated tenants, whereas I deal mainly with vulnerable tenants who very often don’t have an email address (or may not be computer literate, may have mental health issues, or learning difficulties, etc).

I asked if GDPR applies to all government, and local government departments, and she said yes, it applies to all companies and organisations. However, the bloke sat next to her from the Council was asked if the Council were compliant, he said that his Council “are currently looking into it”. If all organisations have to be GDPR compliant, then how will the politicians send us all their party political mailings asking us to vote for them!

Overall, it seems that nobody is quite sure how GDPR will affect individual situations, it is legislation designed for application to massive companies to stop them abusing the data they hold (using it for wrong purposes, or selling it on, etc), but it is applicable to everyone so even one landlord with just one tenant will have to comply with all the GDPR rules.

Are any other landlords having trouble understanding the GDPR compliance rules? Getting misinformation or contradictory advice? Are all landlords aware of how GDPR will affect them, and what they need to do?

Robert


Share This Article


Comments

Chris Clare

Become a Member

If you login or become a member you can view this members profile, comments, posts and send them messages!

Sign Up

13:47 PM, 9th May 2018, About 7 years ago

Reply to the comment left by Robert Mellors at 09/05/2018 - 12:32
I have seen these statements. The problem is making a statement does not make it true.

Whilst there are provisions in GDPR for using services that store data outside of the EU, these provisions come with caveats such as the need to ensure that the receiving country/service has sufficient safeguards in place.

On the basis that most of the people using these services lack the technical ability to self manage, I would think that the additional burden of due diligence necessary under GDPR would also represent a burden difficult to overcome.

However for anyone who has all the appropriate systems and controls in place for dealing with third parties, signing off the likes of Mircrosoft or Google should be within their control.

Boru

Become a Member

If you login or become a member you can view this members profile, comments, posts and send them messages!

Sign Up

13:47 PM, 9th May 2018, About 7 years ago

Reply to the comment left by Chris Clare at 01/05/2018 - 14:12
You would only need to prove the PD thing if it became an issue, ie the trademan complained to the ICO...which is not going to happen as his number is on the side of his van!! PD....we are discussing all sorts of irrevalent and unlikely risks. Keep it simple!

Chris Clare

Become a Member

If you login or become a member you can view this members profile, comments, posts and send them messages!

Sign Up

13:51 PM, 9th May 2018, About 7 years ago

Reply to the comment left by brian O'Donoghue at 09/05/2018 - 13:43
You are right a huge amount of scaremongering is going on.

However it is like speeding down the road that rarely sees a policeman. Whilst you probably won't get a ticket the fact is you can, is it worth the risk.

I agree that getting registered is the most important thing. Having a well thought out privacy statement is the next. Beyond that, for a one man band, just be careful and don't leave your laptop in a taxi.

Chris Clare

Become a Member

If you login or become a member you can view this members profile, comments, posts and send them messages!

Sign Up

13:54 PM, 9th May 2018, About 7 years ago

Reply to the comment left by brian O'Donoghue at 09/05/2018 - 13:47
My point there was, to avoid doing anything people were suggesting giving the tradesman's number to the tenant. My comment was you can't, regardless of the PD, as this has to be managed. Data is data whoever it belongs to.

Just deal with GDPR, then you can share anyone's data with anyone, in accordance with your privacy statement that is.

Whiteskifreak Surrey

Become a Member

If you login or become a member you can view this members profile, comments, posts and send them messages!

Sign Up

13:55 PM, 9th May 2018, About 7 years ago

Reply to the comment left by brian O'Donoghue at 09/05/2018 - 13:43
I fully agree with this comment. Especailly for those who hold a few properties that should be a huge problem. Demonstration that you took GDPR seriously, registering with ICO, having a privacy statement, having the most necessary data stored and protected in your computer it is a key. We give assurance that we will never sell the data, which we will not.
Let's calm down. GDPR is the smallest problem we have now, S24 and its consequences is. I suggest we spend that spare energy on that.

Rob Crawford

Become a Member

If you login or become a member you can view this members profile, comments, posts and send them messages!

Sign Up

14:39 PM, 10th May 2018, About 7 years ago

If your in the Bristol / Bath areas you may be interested in this GDPR session: http://www.allwessex.co.uk/eu-general-data-protection-regulation-course-for-prs-landlords/

Mike

Become a Member

If you login or become a member you can view this members profile, comments, posts and send them messages!

Sign Up

2:05 AM, 11th May 2018, About 7 years ago

Chris Clare, I went to ICO website, and did a self assessment for my position, it did not even ask me question No 7, regarding letting, so I answered all 6 questions as follow:
1. no
2. yes
3.yes
4.yes
5.No
6 yes
(I answered Yes because it says clearly "Also answer ‘yes’ if your organisation makes a profit for its own purposes, as long as the profit is not used to enrich others."
after this question No 7 did not appear and it said clearly
that "You are not required to register"

Chris you stated in your post that you tried this self assessment and you stated that you are not required to register but then you mentioned lower down that you are required to register, please check your post and get it amended to stop confusion.

However the important thing is even if you are not required to register, you can register voluntarily, but still we all have a duty to protect our tenants personal information to our best of abilities and not allow it to fall into unauthorised hands.
That said, it is best to inform your tenant that you intend to comply with the new data protection act (GDPR) and any information you hold on them will be kept safely and only be allowed to be shared with those who are by law obliged to seek it, such as local councils, police and other crime prevention authorities, but you can put some clauses such as you will also provide if requested their personal information to utility companies, electoral register, and also their forward address to anyone seeking this, have them sign this consent, then you are not really breaking the law, because you have taken their written and signed consent.
You can also tell your tenant that once they leave or their tenancy is surrendered you will destroyed their personal information as required by law using suitable methods such as shredding.
Therefore I as a small time landlord will not need to register.
I am also wondering what happens if you have held your tenants and other people's phone numbers on your phone and it gets lost or stolen? You may have text messages that may contain sensitive information and someone getting your phone can access it somehow even if it is locked by a pin number, as some phone repair shops can reset it for a small charge.

Mike

Become a Member

If you login or become a member you can view this members profile, comments, posts and send them messages!

Sign Up

2:39 AM, 11th May 2018, About 7 years ago

Further to my above post, I did not get to answer question No 7, that is because I answered question no 6 as Yes, therefore I tried a second time and this time I answered question 6 as No, this then opened up question 7, then came all those categories, which included lettings, and now the results are opposite i.e i will have to register! thats a big hole in my pocket another £35 down the stinking pan, all these pounds and pennies all add up and to make billions!
So I don't want to mislead anyone, the outcome depends on Question 6, and in my case the question 6 can be answered as Yes because any profits I gain from renting goes into my pocket and not anyone else pockets.

This new ruling is uncalled for small time businesses.

Mike

Become a Member

If you login or become a member you can view this members profile, comments, posts and send them messages!

Sign Up

12:46 PM, 11th May 2018, About 7 years ago

Reply to the comment left by Neil Patterson at 23/04/2018 - 11:33In reply to Neil Patterson's post near the beginning of this article, yes it definitely appears any small organisation such as landlords dealing with personal data of their tenants need Not register with ICO, as long as any profits are not used to enrich others.

How many landlords enrich others? and what is the definition of enriching others, does it mean if your tenant pays you rent money and you can't give that money to your wife?

You must somehow tell your tenants how you store and protect their data and who you may be likely to share it with, and have them sign this consent form so that there is no confusion if you do happen to exchange their details with things like Utility company, anyone asking for forwards address or anyone seeking refernces.
I for one will not be registering.

Chris Clare

Become a Member

If you login or become a member you can view this members profile, comments, posts and send them messages!

Sign Up

13:51 PM, 11th May 2018, About 7 years ago

Reply to the comment left by Mike at 11/05/2018 - 02:05
I could not agree that you would be classed as a not for profit else why on earth are you doing it unless you are actually running a charity.
I agree it is just another stealth tax but the apparent tax is far lower than the definite fines.

Leave Comments

In order to post comments you will need to Sign In or Sign Up for a FREE Membership

or

Don't have an account? Sign Up

Landlord Automated Assistant Read More